CVE-2023-2648: Weaver E-Office uploadify.php unrestricted upload

Published May 11, 2023

Updated

A vulnerability was found in Weaver E-Office 9.5. It has been classified as critical. This affects an unknown part of the file /inc/jquery/uploadify/uploadify.php. The manipulation of the argument Filedata leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-228777 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

1 affected component

weaver E-Office=9.5

Event History

May 11, 2023

CVE Published

08:00 AM

Data Sourced

08:00 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2023-2648?

The severity of CVE-2023-2648 is critical.

How does CVE-2023-2648 affect Weaver E-Office?

CVE-2023-2648 affects Weaver E-Office version 9.5.

What is the vulnerability in Weaver E-Office 9.5 related to?

The vulnerability in Weaver E-Office 9.5 is an unrestricted upload vulnerability in the file /inc/jquery/uploadify/uploadify.php.

How can CVE-2023-2648 be exploited?

CVE-2023-2648 can be exploited remotely by manipulating the Filedata argument to perform an unrestricted upload.

Is there a fix available for CVE-2023-2648?

A fix for CVE-2023-2648 is currently not available. It is advised to update to a newer version of Weaver E-Office when a fix becomes available.